hadikpola[.]alwaysdata[.]net

Analysis of hadikpola.alwaysdata.net indicates that the domain was registered on 21 February 2026 and is presently taken offline. The infrastructure points to a single IPv6 address 2a00:b6e0:1:20:19::1, which is announced by AS60362 belonging to ALWAYSDATA SARL in France. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy.

VirusTotal reports that 12 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion. The SSL certificate is identified only by the label “E7”, providing no evidence of a trusted or extended validation chain. The listed scam type is “Crypto Scam”, suggesting attempts to deceive victims into transferring cryptocurrency or providing wallet credentials.

No additional evidence such as Safe Browsing alerts, Open Threat Exchange entries, or page‑title metadata is available, leaving the exact content of the site unverified. Defenders should continue to block the IPv6 address and the domain at perimeter firewalls and DNS filters, ensure that any outbound traffic to the address is denied, and monitor for related indicators of compromise that reference the same ASN or hosting provider. Because the domain is already offline, the immediate risk is reduced, but the infrastructure could be reused for future campaigns; therefore, ongoing threat‑intel feeds should be consulted for re‑appearance, and any internal alerts that reference the IP or the domain should be investigated promptly.